Extracted

• • Target

    4cdf2ef504ef70b2e6008a86997450d643d2a42acbb90876ce28858c172c4c34

  • Size

    455KB

  • MD5

    cac2eaa37b36f498f29843590fca272e

  • SHA1

    8d2259cdfc35ac1fe8a0e6e723b2fdcc2dd1d805

  • SHA256

    4cdf2ef504ef70b2e6008a86997450d643d2a42acbb90876ce28858c172c4c34

  • SHA512

    7eab5424897adfd35929215baba831651c6784d8ce0ec02df38a7aeb091e354178f2d05c4586de845f486f44ee58359831cf3e94ae21a3995d8ec8e5eac71bfa

  Score

  10^/10

  gozi_ifsbbankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2